McKesson's 8-K locates the stolen data inside third-party applications

Two accounts sit side by side, and they should be read separately. McKesson's own filing and customer notice confirm an incident discovered on August 25, 2026 ^[2], unauthorized access to third-party applications, and exfiltration of data ^[3]. The company has not said which applications, how access was obtained, or what was taken ^[9]. Everything about mechanism comes from the extortionist: ShinyHunters told BleepingComputer it ran vishing against multiple employees, took over their Okta single sign-on accounts, and used those to reach Salesforce and Snowflake ^[5][7]. It claims the Salesforce environment including support cases, and a larger patient-related set out of Snowflake ^[16].

The volume claim is checkable against itself. About 1TB moved between August 21 and August 25 ^[11], and roughly 284 million records is a raw line count rather than a count of people, per ShinyHunters' correction to earlier reporting ^[8]. Divide: 1e12 bytes over 2.84e8 records averages about 3.5 KB each ^[18]. Since the terabyte also carries the Salesforce case data, the true per-row average for the Snowflake set is lower still ^[18]. That is the size of tabular rows, not of patient files with attachments. ShinyHunters says it has not analyzed the data and does not know the unique-individual count ^[10], so nobody currently has a defensible number for how many patients are involved.

The timeline lines up too neatly to ignore. The claimed transfer window closes on the same date McKesson gives as its discovery date ^[17], which puts detection at the end of four days of egress averaging roughly 250 GB per day ^[19]. Whether the discovery interrupted the transfer or merely observed its finish is not in the public record ^[9].

The initial access route matches a known campaign pattern. A second BleepingComputer source identified mckesson[.]claims as part of the campaign ^[14], and ReliaQuest said it is tracking widespread ShinyHunters registration of company[.]claims domains carrying a target's name or abbreviation to impersonate help desks and IT ^[15]. That gives cheap detection material for anyone else in the healthcare supply chain: newly registered .claims domains matching your name, help desk reset volume, and bulk export rates in Salesforce and Snowflake tenants federated to the same identity provider.

Nothing in either account describes malware or a vulnerability ^[9][7]. Endpoint hardening does not touch this chain. The reachable set is whatever the SSO entitlement trusts, so the inventory that matters is which third-party applications hold patient data, which of them sit behind the same IdP, and what query and export ceilings exist inside each one. McKesson meanwhile says materiality is undetermined and that it is not proactively disconnecting systems, while warning customers of intermittent service degradation tied to the attack ^[13][4].